-
-
Notifications
You must be signed in to change notification settings - Fork 4.8k
Closed
Description
Issue Description
When using Google Sign-In to authenticate users on Parse, the adapter is automatically used without any needed configuration, but:
- it's using a development method to authenticate the user's token as stated in google documentation
An easy way to validate an ID token for debugging is to use the tokeninfo endpoint. Calling this endpoint involves an additional network request that does most of the validation for you, but introduces some latency and the potential for network errors.
- there's no clientId validation to ensure the token is from our app
- the sessions that are created are marked as createdWith
{ "action": "signup", "authProvider": "password"}instead of a google provider
Does someone is using Google Sign-In in production?
Metadata
Metadata
Assignees
Labels
No labels